Thought it might be easier to create a new topic, instead of using an old guide: this one .
DietPi version:
G_DIETPI_VERSION_CORE=8
Distro version:
bullseye 0
Kernel version:
Linux DietPi 5.15.32-v8+ #1538 SMP PREEMPT Thu Mar 31 19:40:39 BST 2022 aarch64 GNU/Linux
SBC model:
RPi 3 Model B (aarch64)
Power supply used: 5V 2A
Software: Wireguard Client
Freshly installed DietPi and Wireguard client
New Dietpi installation. (Fresh, basic, OpenSSH, changed CPU setting and timezone)
Installed WireGuard as a client
Created a conf file on the Mullvad website: tunnel traffic: Only IPv4, No Killswitch, block all content
Created /etc/wireguard/mullvad.conf
Copied Mullvad conf file to mullvad.conf:
[Interface]
Started WireGuard (wg-quick up mulvad.conf )
Checked VPN connection: OK (curl ifconfig.me && curl https://am.i.mullvad.net/connected )
Added it to start up: systemctl enable wg-quick@mullvad
Reboot: all OK
Added a killswitch command to mullvad.conf (used it from here:mullvad )
[Interface]
PostUp = iptables -I OUTPUT ! -o %i -m mark ! --mark $(wg show
[Peer]
Reboot: Pi unreabable
ps Pi also unreachable after only adding this:
[Interface]
PostUp = iptables -I OUTPUT ! -o %i -m mark ! --mark $(wg show
[Peer]
Pi makes a VPN connection
Still be able to connect to the Pi (SSH)
Killswitch when VPN is offline. (No connection out and Transmission-deamon killed)
No IPv6 leaking
Pi unreachable, but still showing up in network
I have read on serveral sites about Wireguard & iptables (most are about setting up WG servers):
This is another step in learning more about iptables and network in generally.
If i only execute the first iptable line, after VPN is running (step 5):
iptables -I OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT
I get this message:Unable to access interface: No such device iptables v1.8.7 (nf_tables): mark: bad integer value for option “–mark”, or out of range.
yes because the code line is working inside wireguard config file only as you have a variable %i. This one you need to set manually if you go to execute the code line yourself. Usually it should be wg0.
1 Like
The rules block any outgoing packets that are not tunnelled, hence the Pi isn’t able to answer on any SSH request. You need to add an additional rule to explicitly permit all outgoing SSH packets, or those to your LAN at least.
The LOCAL doesn’t mean LAN here, but loopback/localhost destination only, AFAIK.
2 Likes
You need to add a rule to allow ssh and anything else you need to the dietpi.iptables -I INPUT -i eth0 -p tcp -s 192.168.0.0/24 --dport 22 -j ACCEPT; iptables -I OUTPUT -o eth0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
1 Like
Do I need to add these lines to the mullvad.conf in PostUp?
Or do I add them as persistant iptables?
you can add it into PustUp part and to revert into PostDown.
BTW: there is no need to do screen prints. You could copy everything from SSH terminal directly
Hehe, I don’t have the chance to add it into the confi file yet.
I first added only Trendy’s rule and it was fine:
PostUp = iptables -I INPUT -i eth0 -p tcp -s 192.168.1.0/24 --dport 22 -j ACCEPT && iptables -I OUTPUT -o eth0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPTiptables -I INPUT -i eth0 -p tcp -s 192.168.1.0/24 --dport 22 -j ACCEPT && iptables -I OUTPUT -o eth0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
But the Pi became unreachable after adding this:
PostUp = iptables -I INPUT -i eth0 -p tcp -s 192.168.1.0/24 --dport 22 -j ACCEPT && iptables -I OUTPUT -o eth0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT && iptables -I OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECTiptables -I INPUT -i eth0 -p tcp -s 192.168.1.0/24 --dport 22 -j ACCEPT && iptables -I OUTPUT -o eth0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
ps I changed the IP adress because this computer and the Pi use IP range 192.168.1.XXX
Do it like this:
PostUp = `iptables -I 1 INPUT -i eth0 -p tcp -s 192.168.1.0/24 --dport 22 -j ACCEPT && iptables -I 1 OUTPUT -o eth0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT && iptables -I 2 OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT`
PostDown = `iptables -D INPUT -i eth0 -p tcp -s 192.168.1.0/24 --dport 22 -j ACCEPT && iptables -D OUTPUT -o eth0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT && iptables -D OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT`
When I add these lines to the conf file, without rebooting, I get this message:
root@DietPi:/etc/wireguard# wg-quick up mullvad-de21.confINPUT' Try iptables -h’ or ‘iptables --help’ for more information.
Xperimental:
iptables -I 1 INPUT
I guess the INPUT rule #1 already exist and can’t be set again.
Can it be fixed by replacing rule #1 with #2 and rule #2 with #3 ?
root@DietPi:/etc/wireguard# sudo iptables -S INPUT
There aren’t any rules listed. Nothing is listed when I use the command “sudo iptables -S”
I placed the numbers behind INPUT / OUTPUT, that solved the issue.
2 Likes
When I kill wireguard, this happens and I cannot access the pi anymore:
root@DietPi:/etc/wireguard# wg-quick down mullvad-de21
[#] systemctl stop transmission-daemon
[#] ip -4 rule delete table 51820
[#] ip -4 rule delete table main suppress_prefixlength 0
[#] ip link delete dev mullvad-de21
[#] resolvconf -d tun.mullvad-de21 -f
[#] iptables-restore -n
[#] iptables -D INPUT -i eth0 -p tcp -s 192.168.1.0/24 --dport 22 -j ACCEPT && iptables -D OUTPUT -o eth0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT && iptables -D OUTPUT ! -o mullvad-de21 -m mark ! --mark $(wg show mullvad-de21 fwmark) -m addrtype ! --dst-type LOCAL -j REJECT
I guess the PostDown needs some adjustments?
I think I have found the solution:
PostUp = iptables -I INPUT 1 -i eth0 -p tcp -s 192.168.1.0/24 --dport 22 -j ACCEPT && iptables -I OUTPUT 1 -o eth0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT && iptables -I OUTPUT 2 ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT
PreDown = iptables -D INPUT -i eth0 -p tcp -s 192.168.1.0/24 --dport 22 -j ACCEPT && iptables -D OUTPUT -o eth0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT && iptables -D OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT
Changed place numbers and PostDown to PreDown.
1 Like
New problem:
I am not able to access files from the NAS anymore. The drive is mounted. Is this because of the IP tables?
yes, because you allowed SSH only while VPN is connected.
1 Like
Is there a standard NFS port?
